Overview

overview

8

Static

static

3

setup.exe

windows10-2004-x64

8

setup.exe

windows11-ltsc_2024-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    133s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 18:16

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    setup.exe
  • Size 667KB
  • Sample261018-wwggdahs21
  • SHA256 36bd42317c14d1dc0558859f34330aca8b56b43c1405cdb269bd8afb11a1a8cd
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
defense_evasiondiscoverypersistencespywaretrojan

Malware Config

Signatures

  • Downloads MZ/PE file 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 6 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 25 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 10 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • System Time Discovery 1 TTPs 1 IoCs

    Adversary may gather the system time and/or time zone settings from a local or remote system.

    discovery
  • Modifies data under HKEY_USERS 5 IoCs
  • Modifies registry class 64 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\setup.exe
    "C:\Users\Admin\AppData\Local\Temp\setup.exe"
    1⤵
    • Downloads MZ/PE file
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:4648
    • C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\NetCoreCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\NetCoreCheck.exe" Microsoft.WindowsDesktop.App 8.0.31
      2⤵
      • Executes dropped EXE
      PID:5820
    • C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\NetCoreCheck.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\NetCoreCheck.exe" Microsoft.WindowsDesktop.App 8.0.31
      2⤵
      • Executes dropped EXE
      PID:1668
    • C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe
      "C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe" /q
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:3796
      • C:\Windows\Temp\{5F307BDC-E10B-45A8-BDFB-0A13E0B7955D}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe
        "C:\Windows\Temp\{5F307BDC-E10B-45A8-BDFB-0A13E0B7955D}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.clean.room="C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.filehandle.attached=748 -burn.filehandle.self=752 /q
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • System Time Discovery
        • Suspicious use of WriteProcessMemory
        PID:2096
        • C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\.be\windowsdesktop-runtime-8.0.31-win-x64.exe
          "C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\.be\windowsdesktop-runtime-8.0.31-win-x64.exe" -q -burn.elevated BurnPipe.{0648F7FD-972B-4F65-95BE-742C3EBEC47E} {D5B2767E-A9DD-4FFB-B80F-4472D2C72576} 2096
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious use of AdjustPrivilegeToken
          PID:4836
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 2096 -s 1544
          4⤵
          • Program crash
          PID:5464
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:4524
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 9FE79AA69C824AFC12FDDAFB72B3F99F
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:4088
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5E138B198C64D811830D86DB73D0EBD0
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5072
  • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
    "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" /burn.runonce
    1⤵
    • Executes dropped EXE
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:5872
    • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
      "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1600
      • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
        "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.clean.room="C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -burn.filehandle.attached=560 -burn.filehandle.self=580 /quiet /burn.log.append "C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        • Suspicious use of WriteProcessMemory
        PID:3232
        • C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe
          "C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\windowsdesktop-runtime-8.0.31-win-x64.exe" -q -burn.elevated BurnPipe.{AB92F5F7-6038-4015-82FD-84D22236F5EE} {6D1B9F46-20C8-48B0-A3EF-523C8C808A89} 3232
          4⤵
          • Executes dropped EXE
          • Adds Run key to start application
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          PID:3972
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 3232 -s 1080
          4⤵
          • Program crash
          PID:1440
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 2096 -ip 2096
    1⤵
      PID:5028
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 580 -p 3232 -ip 3232
      1⤵
        PID:4920

      Network

            MITRE ATT&CK Enterprise v16

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            e59cf21.rbs
            • Path C:\Config.Msi\e59cf21.rbs
            • Size 48KB
            • SHA256 252e1f4ee6353cd30895c3979d105f6b4dc97dfed76a544371ee10f4d1fb3cd2
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            e59cf26.rbs
            • Path C:\Config.Msi\e59cf26.rbs
            • Size 9KB
            • SHA256 b9052dde6b729a9db16f5cec446834ba56cb171c6363545041154ee79fb8ea75
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet-hostfxr-8.0.31-win-x64.msi
            • Path C:\ProgramData\Package Cache\{147B0E5B-D916-44F6-A66B-163CF0F723E9}v64.124.58447\dotnet-hostfxr-8.0.31-win-x64.msi
            • Size 776KB
            • SHA256 6049ef4356fa5aadff989cac1bc005f091ceccba4ef618a809205ad8328d7555
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            state.rsm
            • Path C:\ProgramData\Package Cache\{208fff39-3440-44c6-b473-38136ba594bf}\state.rsm
            • Size 1KB
            • SHA256 68910a3d5fd5eb1dd170fd471fe425e9051319397f34891463e16761f5f367a8
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626.log
            • Size 10KB
            • SHA256 51ed9fcf6a486686af515511a4415416e93f6163df88a692db8fb2bdc908e57c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626_000_dotnet_runtime_8.0.31_win_x64.msi.log
            • Path C:\Users\Admin\AppData\Local\Temp\Microsoft_Windows_Desktop_Runtime_-_8.0.31_(x64)_20261018191626_000_dotnet_runtime_8.0.31_win_x64.msi.log
            • Size 2KB
            • SHA256 cc611a3466b42022321ef9ae5976dfe495d69cb7aef1bff4251cb291afd28ea0
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            NetCoreCheck.exe
            • Path C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\NetCoreCheck.exe
            • Size 141KB
            • SHA256 3e1c1d8c5540e45099a501c4bc910222618fc21563644bc9add00ea541b013f9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Test240761312.runtimeconfig.json
            • Path C:\Users\Admin\AppData\Local\Temp\VSD7B9F.tmp\net8desktopruntime_x64\Test240761312.runtimeconfig.json
            • Size 104B
            • SHA256 6a777266b8579f7828894a87a832b9fc6ff84ef716da6105248f2115d5c64ff5
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            MSID7F7.tmp
            • Path C:\Windows\Installer\MSID7F7.tmp
            • Size 219KB
            • SHA256 2bf33a9b9980e44d21d48f04cc6ac4eed4c68f207bd5990b7d3254a310b944ae
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            bg.png
            • Path C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\.ba\bg.png
            • Size 4KB
            • SHA256 9095bf7b6baa0107b40a4a6d727215be077133a190f4ca9bd89a176842141e79
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            wixstdba.dll
            • Path C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\.ba\wixstdba.dll
            • Size 190KB
            • SHA256 dcea15f3710822ffc262e62ec04cc7bbbf0f33f5d1a853609fbfb65cb6a45640
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_host_8.0.31_win_x64.msi
            • Path C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\dotnet_host_8.0.31_win_x64.msi
            • Size 704KB
            • SHA256 6523695f0a8784208c166fd4c7f026d049bebb67f9f426b9f6f70a9f014ad41b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            dotnet_runtime_8.0.31_win_x64.msi
            • Path C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\dotnet_runtime_8.0.31_win_x64.msi
            • Size 26.4MB
            • SHA256 ec6855e09c01c457029b536daeec4208a8a21acdce08250162d02bc0531ca72c
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop_runtime_8.0.31_win_x64.msi
            • Path C:\Windows\Temp\{1D15DCD5-D7C2-41D2-BECF-BFAAD9EC6245}\windowsdesktop_runtime_8.0.31_win_x64.msi
            • Size 29.2MB
            • SHA256 afa54a38d640d211b2c23a19c7d93c80fa922e39bc84f735e109124c33becca3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            windowsdesktop-runtime-8.0.31-win-x64.exe
            • Path C:\Windows\Temp\{5F307BDC-E10B-45A8-BDFB-0A13E0B7955D}\.cr\windowsdesktop-runtime-8.0.31-win-x64.exe
            • Size 607KB
            • SHA256 979eb818a30d9759b4571af89c877597d1fc88b20ddd5f3d0ddd538b70c8b20d
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            BootstrapperApplicationData.xml
            • Path C:\Windows\Temp\{9A9A26A7-1C29-4692-A4A5-B3B0440DF603}\.ba\BootstrapperApplicationData.xml
            • Size 7KB
            • SHA256 5b459acefd453b95c6bb662f766038c48222867db4016bdfb91420493eff1e9f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.wxl
            • Path C:\Windows\Temp\{9A9A26A7-1C29-4692-A4A5-B3B0440DF603}\.ba\thm.wxl
            • Size 5KB
            • SHA256 81a68046b06e09385be8449373e7ceb9e79f7724c3cf11f0b18a4489a8d4926a
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            thm.xml
            • Path C:\Windows\Temp\{9A9A26A7-1C29-4692-A4A5-B3B0440DF603}\.ba\thm.xml
            • Size 11KB
            • SHA256 83ca096f7ba2c83fc3b3aeb697b8139a788fa35eb8632943e26bb9fff7c78e63
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download